Before you even start creating a report, it is definitely a risk you should consider.
If you share projects to User B by their specific name (rather than generally sharing with a team, job role, group, or company) any report you make in order to show other users the "User B work", may not display ...